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Abstract —  Frequency  steer  limits  are  important  aspects  that 
influence  the  overall  response  and  design  of  a  robust  control 
system.  We  study  the  effects  that  frequency  steer  limits  have 
on  the  response  of  a  control  system  when  underlying 
components  of  the  system  have  undergone  non-stochastic 
perturbations.  Examples  of  the  disturbances  include 

environmental  changes  and  hardware  anomalies. 
Additionally,  we  attempt  to  find  a  balance  between  the 
performance  of  the  control  system  and  the  robustness  of 
maintaining  parameter  limits  in  the  presence  of  outlying 
events.  Performance  of  design  strategies  are  evaluated 
utilizing  both  simulated  and  archived  measured  data. 

I.  Introduction 

The  U.S.  Naval  Observatory  (USNO)  maintains  several 
steered  clock  systems.  Each  system  is  comprised  of  a 
hydrogen  maser  that  provides  a  frequency  signal  to  a  high 
precision  frequency  synthesizer.  This  synthesizer  is  steered 
toward  its  target  based  on  a  time  error.  The  principal 
differences  between  any  two  of  these  systems  are  the 
measurement  systems  that  provide  the  phase  value,  the 
algorithms  used,  and  the  target  of  the  control.  The  motive  for 
this  study  is  to  determine  how  limiting  parameters  for  a 
steering  algorithm  may  affect  the  responsiveness  of  the 
control  due  to  perturbations  that  were  not  included  in  the 
system  design  models.  The  objective  is  to  determine  if  the 
control  limits  calculated  using  simulation  previously  [4]  for  a 
noisier  system  are  performing  adequately  for  the  operational 
USNO  Master  Clock  (MC)  in  both  steady-state  and  during 
non-stochastic  disturbances.  We  will  look  at  the  responses 
of  the  fdtered  control  systems  with  respect  to  certain  offsets. 


Figure  1 .  Block  diagram  of  a  typical  control  system  that  creates  a  physical 
realization  of  a  timescale. 


II.  History  of  Steering  USNO  Master  Clock 

A.  Previous  Design 

Prior  to  November  2004  the  USNO  MC  was  steered  in 
frequency  once  per  day  using  a  control  that  attempted  to  take 
out  the  entire  frequency  error  and  a  fraction  of  the  phase 
error  relative  to  the  USNO  A.l  mean  which  is  itself  steered 
to  UTC.  The  state  estimate,  phase  and  frequency  offsets 
with  respect  to  the  steering  goal,  were  determined  by  fitting  a 
line  to  the  available  data  since  the  last  steer.  The  magnitude 
of  an  individual  steer  was  not  allowed  to  exceed  1.75e-15 
which  is  equivalent  to  a  change  in  phase  of  150  picoseconds 
over  one  day.  While  this  design  was  sufficient  for  nominal 
operations,  an  event,  such  as  a  temporary  outage  in 
temperature  control  of  a  chamber,  could  perturb  the  system 
for  up  to  23  hours  before  steering  would  take  out  any 
resulting  clock  error.  Depending  on  the  size  of  the  event,  the 
limitations  placed  on  the  individual  steer  might  not  allow 
steering  to  fully  correct  the  error.  This  was  a  contributing 
factor  in  the  decision  to  change  to  more  frequent  steers. 

B.  Present  Design 

Since  November  2004  the  USNO  MC  has  been  steered  in 
frequency  once  per  hour  using  a  control  that  has  a  time 
constant  of  4  days.  The  present  design  utilizes  a  Kalman 
filter  [1,3]  that  provides  a  better  state  estimate  for  the  MC 
relative  to  a  real-time  hydrogen  maser  mean  than  the 
previous  design.  This  improves  the  short  term  stability 
utilized  as  the  input  to  the  control  system.  The  magnitude  of 
an  individual  steer  may  not  exceed  2.7e-16,  and  the 
accumulated  effect  of  the  hourly  steering  may  not  move  the 
MC  more  than  200  picoseconds  over  any  24  hour  period. 
Figure  2  gives  examples  of  minimal  clock  changes  that 
would  require  the  use  of  the  present  steering  limits  and  the 
control  response  to  these  events. 

Even  though  this  design  has  the  potential  to  be  more 
aggressive  than  the  previous  design,  it  has  proved  to  be  much 
gentler.  In  fact,  as  figure  3  shows,  the  range  of  the 
accumulated  effect  of  steering  over  a  day  under  the  present 
design  is  approximately  a  third  of  the  range  of  accumulated 
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effect  under  the  previous  design.  This  is  partially  explained 
by  the  ability  of  the  present  design  to  react  more  quickly  to 
an  event  which  allows  for  the  correction  to  be  much  smaller. 
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Figure  2.  Shows  the  minimum  frequency,  phase,  and  drift  steps  that  will 
cause  the  2.7e-16  steer  limit  to  be  reached  in  the  present  system  design. 
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Figure  3.  Box  plot  of  daily  accumulated  phase  of  the  previous  and  present 
control  system  designs. 


111.  Proposed  Design  Changes 

The  present  design  has  proven  to  be  more  than  sufficient 
for  normal  conditions.  In  many  respects  it  far  exceeds  the 
necessary  conditions  for  nominal  operations  as  is  easily 
evidenced  by  how  far  within  the  limits  the  control  has 
remained  over  the  several  months  analyzed  which  is  shown 
by  figure  4.  While  having  a  system  that  can  react  to  events 
without  raising  alarms  is  not  necessarily  a  bad  thing,  it  would 
be  more  advantageous  for  the  control  limits  to  be  kept  in  line 
with  what  is  required  in  day-to-day  operations  while  having 
the  flexibility  to  expand  those  limits  in  the  presence  of  an 
event  that  calls  for  more  aggressive  steering.  This  requires  a 
more  reasonable  set  of  limitations,  a  means  of  detecting  a 
problem,  and  the  determination  of  an  expanded  set  of 


limitations  sufficient  to  deal  with  any  problem  we  can 
foresee. 

A.  More  Restrictive  Limits 

As  figures  3  &  4  plainly  show,  control  of  the  MC  can  be 
maintained  in  normal  conditions  by  limits  for  an  hourly 
steer  of  1.0e-16  and  an  accumulated  phase  effect  of  100 
picoseconds  over  any  24  hour  period.  Over  the  several 
months  analyzed,  only  7  times  have  we  required  a  single 
steer  in  excess  of  this  new  hourly  limitation  and  only  three 
times  have  we  required  an  accumulated  effect  in  excess  of 
the  new  24-hour  limitation.  Figure  5  provides  examples  of 
events  sufficiently  large  to  require  a  maximum  steer  and  the 
control  reaction  to  those  events.  The  events  are  all  well 
within  the  expected  performance  parameters  of  a  hydrogen 
maser  under  normal  conditions. 
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Figure  4.  Frequency  steers  of  the  operational  USNO  Master  Clock. 
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Figure  5.  Shows  the  minimum  frequency,  phase,  and  drift  steps  that  will 
cause  the  1  e- 1 6  steer  limit  to  be  reached  in  the  proposed  system  redesign. 
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B.  Detecting  and  Reacting  to  Anomolies 

Under  the  more  restrictive  limits,  early  detection  of 
potential  perturbations  to  the  MC  becomes  critical  to 
operations.  Finding  a  large  step  in  phase  is  relatively  easy 
due  to  frequent  comparisons  between  the  MC  and 
independent  back  up  master  clocks  also  located  at  USNO. 
The  cause  of  the  step  can  also  be  found  without  much 
difficulty  due  to  the  measurement  of  the  MC  components 
against  both  the  MC  and  the  back  ups.  In  most  cases,  these 
hardware  failures  will  require  manual  intervention  to  repair 
or  replace  a  component,  and  the  step  generally  must  be 
removed  in  hardware  as  well. 

Detection  of  a  step  in  frequency  is  slightly  more  difficult 
since  frequency  must  be  estimated  from  phase 
measurements.  However,  proactive  steps  can  be  taken  to 
predict  such  frequency  changes  by  watching  for  events  that 
are  known  to  cause  a  change  in  maser  frequency:  e.g.  change 
in  environmental  conditions,  change  in  maser  parameters. 
These  are  monitored  frequently,  and  a  simple  Shewart  chart 
[2]  allows  for  the  detection  of  a  significant  change  in 
conditions  that  might  lead  to  a  MC  frequency  change  that 
would  require  more  aggressive  steering.  A  distribution 
determined  from  analysis  of  historical  data  is  assigned  to 
each  data  set  that  is  monitored,  and  behavior  of  that  data  set 
that  is  not  consistent  with  the  assigned  distribution  will  raise 
an  alarm.  The  more  restrictive  steering  limits  may  be 
employed  until  such  an  event  occurs.  At  that  point,  limits 
may  be  expanded  to  a  level  that  will  allow  automatic  steering 
to  maintain  control.  It  is  assumed  that  if  the  frequency  offset 
is  calculated  to  be  larger  than  the  expanded  limits  can  handle 
that  the  event  is  catastrophic  and  human  involvement  is 
necessary  for  that  system. 

Following  the  detection  of  an  anomaly  that  can  not  be 
attributed  to  the  system  reference  or  target,  new  expanded 
limits  must  be  set  for  the  control.  The  present  limits  of 
2.7e-16  and  200  picoseconds  over  any  24  hour  period  are 
sufficiently  aggressive  for  most  events  that  would  not 
require  human  intervention  for  repair. 

C.  Analysis 

The  MC  data  from  November  2004  to  June  2005  was 
de-steered  and  used  as  the  input  for  a  simulation  that  steered 
the  clock  using  the  proposed  design.  During  this  period  of 
time  there  were  no  events  that  required  an  increase  of 
steering  limits,  so  the  steers  applied  were  limited  to  the 
proposed  1.0e-16  for  each  hourly  steer  and  no  more  than 
100  picoseconds  of  accumulated  phase  over  any  24  hour 
period  for  the  entire  data  set.  MC  deviation  from  the 
steering  goal  was  not  increased  using  these  new  limits,  and 
stability  of  the  MC  was  similarly  unaffected. 


Figure  6.  Time  Difference  of  the  Master  Clock  vs.  USNO  timescale  as 
measured  during  operations  and  re-steered  in  simulation  with  the  proposed 
1 E- 1 6  steering  limit. 

IV.  Conclusion 

We  have  determined  that  the  control  limits  proposed  in 
[4]  are  too  broad  for  our  Master  Clock  system  design.  This 
is  likely  due  to  the  conservative  estimates  used  for 
simulating  the  performance  of  the  underlying  hydrogen 
maser  and  the  better  short  term  stability  of  the  Kalman  filter 
estimates  utilized  for  the  present  Master  Clock  system  input. 
We  now  propose  a  more  robust  solution  with  tighter  steering 
limits  and  intelligent  decision  making  that  will  adjust  the 
limits  if  any  divergence  is  found  to  be  the  result  of  a 
perturbation  to  the  steered  components  of  system  and  not  the 
reference  timescale. 
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